Indiana — Consumer Data Protection Act (IC 24-15; in force 1 Jan 2026 — profiling opt-out + DPIAs) + State AI Laws (HEA 1133 election fabricated media; HEA 1047 AI intimate images; HEA 1271 insurer/provider AI claim review; SEA 256 AI-vendor state contracts) + Federal AI Profile: AI Compliance Requirements

HEA 1133 / Public Law 81-2024 (effective July 1, 2024) adds IC 3-9-8 ("Use of Digitally Altered Media in Elections"). IC 3-9-8-5 requires a campaign communication that includes "fabricated media depicting a candidate" to carry the disclaimer "Elements of this media have been digitally altered or artificially generated," with the disclaimer prescribed separately for printed, audio and video formats. IC 3-9-8-6 gives the remedy to the depicted candidate, not to a state agency: "A candidate depicted in fabricated media that is included in a campaign communication that does not include a disclaimer required by section 5 of this chapter may bring a civil action," recovering "the plaintiff's actual damages," "injunctive relief," and "the amount of any court costs and reasonable attorney's fees." Practical consequence for any Indiana political-media, agency or platform workflow: generative-AI depictions of a real candidate must be disclaimed at the point of distribution in every format, and the exposure is uncapped civil damages plus fee-shifting rather than a bounded regulatory fine. Statutory text verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, stamped "Current as of January 01, 2026" (iga.in.gov serves only a JS shell to this toolchain). legal_review_pending.

The Indiana Consumer Data Protection Act (SEA 5, 2023; IC 24-15) has been IN FORCE since 1 January 2026. IC 24-15-3-1(b) gives an Indiana consumer the right to confirm and access, correct, delete, obtain a portable copy or representative summary, and "opt out of the processing of the consumer's personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer." "Profiling" is defined at IC 24-15-2-23 as "any form of solely automated processing" performed on personal data to evaluate, analyze or predict personal aspects relating to an identified or identifiable individual's economic situation, health or health records, personal preferences, interests, reliability, behavior, location or movements — so the opt-out reaches AI scoring, ranking, eligibility and targeting models applied to Indiana residents, and the "solely automated" qualifier means a genuine, documented human decision step takes a process outside the definition. A controller must respond within 45 days, extendable once by a further 45 days, free of charge up to once annually per consumer, and must offer an internal appeal process for refusals. Note the Indiana-specific narrowing: "sale of personal data" means exchange for MONETARY consideration (IC 24-15-2 definitions), which is narrower than the "other valuable consideration" formulations in several sister states — do not assume a California/Colorado analysis transfers. Statutory text verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, stamped "Current as of January 01, 2026". legal_review_pending.

IC 24-15-6-1 requires a controller to conduct and document a data protection impact assessment before each of: processing personal data for targeted advertising; the sale of personal data; the processing of sensitive data; "any processing activities involving personal data that present a heightened risk of harm to consumers"; and — the AI-critical trigger — profiling that presents a reasonably foreseeable risk of "unfair or deceptive treatment of, or unlawful disparate impact on, consumers," of "financial, physical, or reputational injury to consumers," of "a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, if such intrusion would be offensive to a reasonable person," or of "other substantial injury to consumers." The assessment must identify and weigh the benefits of the processing against the risks to consumer rights, accounting for the use of de-identified data, reasonable consumer expectations, and the context of the processing. This is the operative disparate-impact testing obligation for AI models deployed against Indiana consumers, and it maps closely onto the EEOC adverse-impact analysis already required of employment tools — a single model-risk file can satisfy both if it is scoped to Indiana consumers as well as applicants. Timing carve-out to diary: the chapter "appl[ies] to processing activities created or generated after December 31, 2025, and [is] not retroactive to any processing activities created or generated before January 1, 2026," so legacy models escape only until they are materially changed or newly deployed. Verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, "Current as of January 01, 2026". legal_review_pending.

IC 24-15-4-1 imposes the controller duties that govern AI training and inference inputs: limit collection of personal data to what is "adequate, relevant, and reasonably necessary" for the disclosed purposes; do not process personal data for purposes incompatible with those disclosed without the consumer's consent (which squarely covers repurposing customer data as model training data); maintain reasonable administrative, technical and physical data security practices; and — the provision that carries the biometric duty — "A controller shall not process sensitive data concerning a consumer without obtaining the consumer's consent," with children's data handled under COPPA. "Sensitive data" (IC 24-15-2-28) includes personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a health care provider, sexual orientation, or citizenship or immigration status, and "genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual" — so face, voice, fingerprint, retina/iris and comparable biometric matching used by Indiana workforce, access-control or retail AI needs prior consent. IC 24-15-4-1 also bars discriminating against a consumer for exercising a right, including denying goods or services or charging a different price in retaliation, while permitting genuine loyalty-program and opt-out-driven differences. VERIFY-THE-NEGATIVE: Indiana has NO standalone BIPA-style biometric statute and no biometric private right of action — this consent duty, AG-enforced, is the whole of Indiana biometric law. Verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, "Current as of January 01, 2026". legal_review_pending.

HEA 1271 adds a new chapter IC 27-1-52 ("Downcoding of Health Benefits Claims"), effective July 1, 2026 and now live. IC 27-1-52-9 states the AI rules in three parts. (a) An insurer "may not use an automated: (1) process; (2) system; or (3) tool, including artificial intelligence; as the sole basis to downcode a claim based on medical necessity without the review of the covered individual's medical record by an employee or contractor of the insurer." (b) The SAME prohibition runs the other way — "A provider may not use an automated ... tool, including artificial intelligence; to submit a health benefits claim without the review of a provider or other person involved in the development of the claim for submission" — so revenue-cycle and autonomous-coding AI on the provider side is regulated too, a duty missing from earlier versions of this entry. (c) "An insurer must disclose in an easily accessible and readable manner when artificial intelligence is used to: (1) make an adverse determination on a prior authorization request; or (2) downcode a claim." Scope traps that decide applicability: "insurer" expressly includes "a third party contractor" of an insurer, HMO or dental preferred-provider plan (IC 27-1-52-6(4)), so AI vendors and delegated utilization-review firms are directly bound rather than merely contractually flowed-down; and the chapter "does not apply to the Medicaid program or a managed care organization ... that provides services to a Medicaid recipient" (IC 27-1-52-0.3). Surrounding duties in the same chapter shape the audit trail an AI pipeline must emit: downcoding notice via the appropriate CARC and RARC with the specific clinical criteria relied on (IC 27-1-52-11), an appeal window of not less than 180 days with batch appeals for substantially similar issues (IC 27-1-52-12), no downcoding based solely on the reported diagnosis code (IC 27-1-52-10), and no targeted or discriminatory downcoding against providers who routinely treat complex or chronic conditions (IC 27-1-52-13) — an anti-disparate-impact rule aimed squarely at model behaviour. Text verified 2026-08-25 by reading the enrolled act PDF itself via an S3 mirror of the IGA document (iga.in.gov serves this toolchain a JS shell). legal_review_pending.

Indiana runs one of the tighter state breach clocks and it governs AI incidents (model or vendor compromise, prompt/log exfiltration, training-corpus exposure) exactly as it governs any other system: "A person required to make a disclosure or notification under this chapter shall make the disclosure or notification without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach" (IC 24-4.9-3-3). Delay is permitted only in response to a request from the Attorney General or a law enforcement agency. Because the 45 days run from DISCOVERY rather than from confirmation or completion of a forensic investigation, an AI vendor contract that lets a processor sit on an incident while it investigates will breach the Indiana clock; flow-down notice obligations should be set materially shorter than 45 days. The Attorney General enforces, and unlike the INCDPA this chapter carries a six-figure ceiling. Statutory text verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, "Current as of January 01, 2026". legal_review_pending.

FTC Act § 5 applies to all Indiana businesses using AI. Ensure AI-generated product claims are truthful, AI chatbots disclose their nature, and AI-driven pricing and marketing practices are not unfair or deceptive. Indiana consumer protection law (Ind. Code § 24-5-0.5) may apply independently to deceptive AI claims.

Indiana's large manufacturing sector (Subaru, Stellantis, Toyota) and logistics companies increasingly use AI for worker monitoring, scheduling, and safety alerts. EEOC May 2023 technical assistance requires employers to test AI employment tools for disparate impact on race, sex, age, and disability. Manufacturing AI vendors must provide disparate impact documentation. Ensure AI worker surveillance does not have discriminatory scheduling or performance effects.

HEA 1047 (2024, effective July 1, 2024) amended Indiana's non-consensual intimate image offence so that an "intimate image" expressly includes a photograph, digital image, computer-generated image or video "created or modified by means of a computer software program, artificial intelligence, application, or other digital editing tools" (IC 35-45-4-8). Distribution of such an image without the depicted person's consent is a criminal offence prosecuted by county and district attorneys, with statutory exceptions for criminal investigations, mandated reports, court orders and news reporting. This is a private-binding AI law and it is the reason the frequently repeated claim that "Indiana has only two AI laws" is wrong; it also means an Indiana-facing generative image or video product needs consent, provenance and takedown controls at the distribution layer, not merely at the model layer. Distinguish it from the separate bill HB 1182 (AI NCII), which was NOT enacted and must not be cited as law. Statutory text verified 2026-08-25 against the Indiana Code mirror at codes.findlaw.com, "Current as of January 01, 2026"; sentencing ranges verified against IC 35-50-3-2 and IC 35-50-2-7 in the same mirror. legal_review_pending.

SEA 256 adds a new chapter IC 1-1-15.3, "Prohibition on Technology Contracts with Certain Foreign Owned Companies," effective July 1, 2026. IC 1-1-15.3-6 defines a "technological product or service" as "a product or service used for information systems, surveillance, light detection and ranging, or artificial intelligence" (excluding unmanned aerial systems), which places AI products squarely inside the chapter. IC 1-1-15.3-7 provides that after June 30, 2026 for a NEW contract, and after June 30, 2027 for an EXISTING contract that is amended or renewed, a contract by a "qualified entity" — the state, a state agency, or a political subdivision — for such a product or service "must contain a provision requiring the contractor to confirm that the contractor and any subcontractors working under the contract for the contractor are not prohibited persons," and "A breach of the provisions under this section may be regarded as a material breach of the contract." "Prohibited person" (IC 1-1-15.3-4) reaches entities organized or headquartered in a foreign adversary — the People's Republic of China, the Russian Federation, North Korea, Iran, a foreign government listed in 15 CFR 791.4, or a country the governor designates a critical-infrastructure threat under IC 1-1-16-8 — or having a controlling person (51% beneficial owner, officer/director with inside information, or a person able to affect management or policies) who is a citizen of or domiciled in a foreign adversary, with carve-outs for US citizens, lawful permanent residents, dual citizens and asylees. Practical effect for an AI vendor: model-supply-chain and subcontractor ownership diligence becomes a contract-formation prerequisite for Indiana public-sector sales, and a stale answer is a material breach rather than a mere representation. Text verified 2026-08-25 by reading SENATE ENROLLED ACT No. 256 itself via an S3 mirror of the IGA enrolled PDF. legal_review_pending.

Indiana's financial services sector and fintech companies using AI credit scoring must comply with FCRA adverse action notice requirements. CFPB Circular 2022-03 requires specific adverse action reasons from the consumer's file — not generic model outputs. Auto lenders financing Indiana vehicle manufacturing output (Toyota, Stellantis) also face FCRA obligations for AI-assisted financing decisions.

Indiana is home to major pharmaceutical and medical device companies (Eli Lilly, Roche Diagnostics, Cook Medical). AI systems meeting the FDA's definition of Software as a Medical Device require FDA 510(k) clearance or De Novo authorization. AI diagnostic tools, clinical decision support, and drug discovery AI must comply with FDA's 2021 AI/ML-Based SaMD Action Plan and 2023 marketing submission guidance.

Monitor the Indiana General Assembly for private-sector AI legislation, but do NOT monitor by bill title. Demonstrated 2026-08-25: the Governor's own signed-legislation repository for the 2026 session lists roughly 180+ enacted bills and NOT ONE description mentions artificial intelligence, deepfakes, algorithms or privacy — yet two of those bills contain Indiana's newest AI obligations, HEA 1271 (listed as "Payment of health claims", carrying IC 27-1-52-9's AI prohibitions) and SEA 256 (a "state offices and administration" act, carrying IC 1-1-15.3's AI-vendor contract rule). A title scan or an AI-keyword bill-tracker count would have scored Indiana at zero AI enactments for 2026. Only enrolled text settles the question, so review enrolled acts in the insurance, elections, criminal-law, procurement and health-services subject areas each session. Two further monitoring notes carrying negative findings as of this date: Indiana has enacted NO AI-chatbot statute and does not appear in the Future of Privacy Forum 2026 chatbot-legislation tracker (fifteen states do), and Indiana has NOT adopted the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers — it is uncoloured on the NAIC Big Data & AI (H) Working Group implementation map "Status as of April 1, 2026" and absent from that map's 25-jurisdiction reference list — so watch for a statutory instrument like IC 27-1-52 rather than for an insurance bulletin. Also diary Department of Insurance rulemaking under IC 27-1-52-14, which will supply the enforcement detail the statute omits. Tooling note for whoever next verifies this entry: iga.in.gov serves this toolchain a bare JS shell for HTML pages and for its own static Code and bill PDFs, and events.in.gov (AG press releases) returns HTTP 403; use the codes.findlaw.com Indiana Code mirror (carries a "Current as of" stamp) and the billtexts S3 mirror of IGA enrolled-act PDFs.